@nowcrew/daemon 0.6.64 → 0.6.65

package/dist/runtimes/codex-turn-retry.js

@@ -0,0 +1,69 @@
+/**
+ * Codex app-server turn 级重试决策(spec Part 1)。
+ *
+ * attempt 只上报两个正交事实:retryReason(为什么值得重试)与 unsafeToRetry(本 turn 是否已有
+ * 白名单之外的工具活动)。外层循环通过 decideTurnRetry 单一出口判断,所有原因共用一个预算。
+ * 2026-08-10 事故根因:模型自己调 collaboration.interrupt_agent,Codex 把父 turn 也置为
+ * interrupted;旧代码直接 exit 130。同时旧的网关过载重试是无条件的,会重放 crew message send。
+ */
+import { isReadOnlyCrewCommand } from "./codex-command-safety.js";
+/**
+ * Codex app-server v2 `codex app-server generate-json-schema` ThreadItem 枚举的全部 18 种类型,
+ * 逐一裁定安全性(2026-08-28 最终评审 F1:实测真实 app-server 0.150.1 发现 userMessage 缺失导致
+ * 所有 turn 被判不安全,回归影响过载重试与 interrupted 重试两条路径)。新增协议类型时,必须在此
+ * 表格里显式落座,不允许静默归类。
+ *
+ * safe(协议/叙述类,无副作用,共 9 种):
+ *   - userMessage        Codex 对我们自己发送的 prompt 的回显,每个 turn 必有
+ *   - hookPrompt          hook 触发的系统提示回显
+ *   - agentMessage        模型最终回复文本
+ *   - reasoning           模型推理过程(不透出给下游)
+ *   - plan                模型计划更新
+ *   - contextCompaction   上下文压缩通知
+ *   - sleep               模型主动等待
+ *   - enteredReviewMode   进入 review 模式通知
+ *   - exitedReviewMode    退出 review 模式通知
+ * conditional(1 种,视具体内容而定):
+ *   - commandExecution    仅当 isReadOnlyCrewCommand(command) 为 true 时安全
+ * unsafe(有副作用或无法判断,共 8 种 + 未知类型):
+ *   - fileChange          写文件
+ *   - mcpToolCall          调用外部 MCP 工具
+ *   - dynamicToolCall      调用动态工具
+ *   - collabAgentToolCall  协作工具(spawnAgent/interrupt_agent 等)
+ *   - subAgentActivity     子 agent 活动
+ *   - webSearch            联网搜索
+ *   - imageView            查看图片
+ *   - imageGeneration      生成图片
+ *   - (任何未知/缺失 type)  一律视为不安全
+ */
+const NARRATIVE_ITEM_TYPES = new Set([
+    "userMessage",
+    "hookPrompt",
+    "agentMessage",
+    "reasoning",
+    "plan",
+    "contextCompaction",
+    "sleep",
+    "enteredReviewMode",
+    "exitedReviewMode",
+]);
+/** 白名单判定:只有叙述类 item 和白名单内的 crew 只读命令是安全的;其它一切(含未知类型)不安全。 */
+export function itemMakesTurnUnsafe(item) {
+    if (item?.type === undefined)
+        return true;
+    if (NARRATIVE_ITEM_TYPES.has(item.type))
+        return false;
+    if (item.type === "commandExecution") {
+        return typeof item.command !== "string" || !isReadOnlyCrewCommand(item.command);
+    }
+    return true;
+}
+export function decideTurnRetry(result, turnRetries, maxRetries) {
+    if (result.retryReason === undefined)
+        return { kind: "return" };
+    if (result.unsafeToRetry)
+        return { kind: "skipped", reason: result.retryReason };
+    if (turnRetries < maxRetries)
+        return { kind: "retry", reason: result.retryReason };
+    return { kind: "exhausted", reason: result.retryReason };
+}

package/dist/runtimes/codex.js

@@ -5,6 +5,8 @@
 import spawn from "cross-spawn";
 /** Minimum CLI whose real app-server contract supports NowCrew native project workspaces. */
 export const CODEX_NATIVE_WORKSPACE_MIN_VERSION = "0.148.0";
+/** Minimum CLI whose `multi_agent` collaboration tool contract was empirically verified (2026-08-28). */
+export const CODEX_COLLABORATION_MIN_VERSION = "0.149.1";
 // Codex CLI 原生 model_reasoning_effort 档位(codex 0.135.0 实测:非法值时 config 解析报错枚举这六档)。
 // 注意:codex 对非法值是硬失败(进程直接退出),所以必须白名单过滤;白名单外(含 "default"、
 // claude 专属的 "max")回落 CODEX_DEFAULT_EFFORT。
@@ -22,6 +24,8 @@ export function buildCodexArgs(input) {
         ? input.reasoning
         : CODEX_DEFAULT_EFFORT;
     args.push("-c", `model_reasoning_effort=${effort}`);
+    // 纵深防御:exec 启动器没有 initialize 握手、无法断言版本,协作工具恒关(spec 2b)。
+    args.push("-c", "features.multi_agent=false", "-c", "features.multi_agent_v2=false");
     if (input.projectRootMarkers) {
         args.push("-c", `project_root_markers=${JSON.stringify(input.projectRootMarkers)}`);
     }

package/dist/serve.js

@@ -51,6 +51,7 @@ import { handleRuntimeProbeFrame, probeRuntimeHealth } from "./runtime-health.js
 import { buildControlPlaneUrl } from "./control-plane-url.js";
 import { createServeMigrationController, handleMigrationControlMessage } from "./daemon-migration-wiring.js";
 import { createCodexHomeModeController } from "./codex-home-mode-controller.js";
+import { attachStorageMigrationRuntime, createServeStorageStatusDelivery, handleStorageMigrationControl, replayStorageMigrationStatus, storageMigrationCapabilities, } from "./storage-serve-adapter.js";
 export { buildControlPlaneUrl } from "./control-plane-url.js";
 // normalize.ts 的活动种类 → activity 枚举
 const ACTIVITY_MAP = {
@@ -122,6 +123,7 @@ export function serve(config, opts = {}) {
             catch { /* reconnect/timeout reconciliation handles a lost status frame */ }
         },
     });
+    let storageMigrationAdmissionClosed = () => false;
     const migrationController = createServeMigrationController({
         config,
         ...(opts.profileName === undefined ? {} : { profileName: opts.profileName }),
@@ -142,6 +144,7 @@ export function serve(config, opts = {}) {
     const agentAbilityRuntime = createAgentAbilityRuntime(config.agentsRoot, {
         ...opts.agentAbility,
         coordinator: projectionCoordinator,
+        isAdmissionClosed: () => storageMigrationAdmissionClosed(),
     });
     let projectSkillsController;
     const projectSkillsReconciler = opts.projectSkills?.reconciler ?? createProjectSkillsReconciler({
@@ -161,6 +164,7 @@ export function serve(config, opts = {}) {
             }
             catch { /* 下一次 ready 或项目操作会重新发送完整快照 */ }
         },
+        isAdmissionClosed: () => storageMigrationAdmissionClosed(),
         reconcile: (handle, bindings) => projectSkillsReconciler.reconcile(handle, bindings),
         ensureSnapshot: (handle, snapshot, options) => projectSkillsReconciler.ensureSnapshot(handle, snapshot, options),
     });
@@ -175,13 +179,37 @@ export function serve(config, opts = {}) {
     });
     const machineHelloPublisher = createProjectSkillMachineHelloPublisher({
         status: projectSkillControllerReadiness.status,
-        effective: withProjectSkillCapabilityStatus,
+        effective: (hello, status) => {
+            const effective = withProjectSkillCapabilityStatus(hello, status);
+            const configuredIdentity = opts.storageMigration?.identity;
+            const currentIdentity = typeof configuredIdentity === "function"
+                ? configuredIdentity()
+                : configuredIdentity;
+            return currentIdentity === undefined ? effective : { ...effective, ...currentIdentity };
+        },
         onSent: (hello) => log(`📤 已上报机器信息: ${hello.hostname} · ${hello.os} · installed=[${hello.runtimes.join(",")}] · executable=[${hello.executionRuntimes.join(",")}] · agents=[${hello.agentHandles.join(",")}]`),
     });
     const initializedProjectSkills = initializedProjectSkillsReconciler(projectSkillControllerReadiness.ensure, projectSkillsReconciler);
+    const configuredCapabilities = opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform);
+    const storageCapabilities = storageMigrationCapabilities(configuredCapabilities, opts.storageMigration);
+    const storageStatusDelivery = createServeStorageStatusDelivery(opts.storageMigration, {
+        onPersistenceError: (error) => dslog("daemon.storage_status_outbox_failed", "存储迁移状态 outbox 持久化失败", { level: "ERROR", error_message: error.message }),
+        transmit: (frame) => { try {
+            if (ws?.readyState === WebSocket.OPEN)
+                ws.send(JSON.stringify(frame));
+        }
+        catch { /* retry */ } },
+    });
+    const storageMigrationRuntime = attachStorageMigrationRuntime(opts.storageMigration, {
+        isBusy: () => executionRuns.size > 0 || legacyRuns.size > 0,
+        waitForExecutionFrames: () => executionFrameQueue,
+        flushLocalState: flushSlog,
+        sendStatus: storageStatusDelivery.send,
+    });
+    storageMigrationAdmissionClosed = storageMigrationRuntime.isAdmissionClosed;
     const prepareProjectSkillCapabilities = createProjectSkillConnectionCapabilityProvider({
         platform: process.platform,
-        baseCapabilities: opts.machineInfo?.capabilities ?? daemonCapabilities(process.platform),
+        baseCapabilities: storageCapabilities,
         additionalCapabilities: () => managedDaemonCapabilities(updateEligibility),
         probeRuntimeRootStorePrimitive: projectSkillRuntimeRootStartup.probeNativePublicationPrimitiveReadiness,
         initializeController: projectSkillControllerReadiness.ensure,
@@ -310,6 +338,12 @@ export function serve(config, opts = {}) {
             // 连上了才有机会把离线期间(断连原因/退出前)落盘的日志补传上去
             void drainSpool();
             // 上报本机信息 (hostname/os/daemon 版本/已装 runtimes)
+            storageStatusDelivery.replayPending();
+            const storageReplay = replayStorageMigrationStatus(opts.storageMigration, openedSocket, () => ws === openedSocket, (error) => {
+                dslog("daemon.storage_status_replay_failed", "存储迁移状态重放失败", {
+                    level: "ERROR", error_message: error.message,
+                });
+            }, storageStatusDelivery.send);
             const { detectInstalled, detectExecutable = detectExecutionRuntimesWithSignal } = opts.machineInfo ?? {};
             const helloPromise = (opts.machineInfo?.collect ?? collectMachineHello)(config.agentsRoot, config.executionLimits, process.platform, {
                 ...(detectInstalled ? { detectInstalled } : {}),
@@ -325,6 +359,7 @@ export function serve(config, opts = {}) {
                 if (hello.executionProtocol === undefined)
                     return [];
                 const detected = await runtimeProbe.detect(hello.runtimes, detectExecutable);
+                await storageReplay;
                 if (ws === openedSocket && openedSocket.readyState === WebSocket.OPEN
                     && detected.some((runtime) => !hello.executionRuntimes.includes(runtime))) {
                     detectedExecutionRuntimes = detected;
@@ -339,7 +374,8 @@ export function serve(config, opts = {}) {
                 return [];
             });
             void helloPromise
-                .then((hello) => {
+                .then(async (hello) => {
+                await storageReplay;
                 if (ws !== openedSocket || openedSocket.readyState !== WebSocket.OPEN)
                     return;
                 detectedExecutionRuntimes = hello.executionRuntimes;
@@ -387,6 +423,8 @@ export function serve(config, opts = {}) {
             if (typeof decoded !== "object" || decoded === null)
                 return;
             const rawType = "type" in decoded && typeof decoded.type === "string" ? decoded.type : "";
+            if (storageStatusDelivery.acknowledge(decoded))
+                return;
             if (rawType === "daemon:update" || rawType === "daemon:restart") {
                 void updateController.handle(decoded).catch((error) => {
                     dslog("daemon.control_failed", "daemon 控制操作处理失败", {
@@ -403,6 +441,11 @@ export function serve(config, opts = {}) {
                 void codexHomeModeController.handle(decoded).catch((error) => dslog("daemon.codex_home_mode_failed", "Codex Home 模式切换失败", { level: "ERROR", error_message: error.message }));
                 return;
             }
+            if (handleStorageMigrationControl(opts.storageMigration, rawType, decoded, storageStatusDelivery.send, (kind, error) => {
+                dslog(kind === "migration" ? "daemon.storage_migration_failed" : "daemon.storage_migration_confirmation_failed", kind === "migration" ? "存储迁移控制操作失败" : "存储迁移 hello 确认处理失败", { level: "ERROR", error_message: error.message });
+            })) {
+                return;
+            }
             if (rawType.startsWith("execution:")) {
                 const parsedExecution = ServerToDaemonExecutionFrameSchema.safeParse(decoded);
                 if (!parsedExecution.success) {
@@ -464,6 +507,14 @@ export function serve(config, opts = {}) {
                         return;
                     }
                     const spec = frame;
+                    if (storageMigrationRuntime.isAdmissionClosed()) {
+                        safeExecutionSend(ExecutionRejectedSchema.parse({
+                            type: "execution:rejected", protocolVersion: 1, executionId: spec.executionId,
+                            reason: "resource_limit", message: "Storage migration is quiescing this machine",
+                            at: new Date().toISOString(),
+                        }));
+                        return;
+                    }
                     const workspaceRejection = projectWorkspaceCapabilityRejection(spec, capabilities.executionRunner, new Date().toISOString());
                     if (workspaceRejection !== null)
                         return void safeExecutionSend(workspaceRejection);
@@ -770,6 +821,17 @@ export function serve(config, opts = {}) {
                 // ready 帧带 server 视角的 machineId/workspaceId → 作为后续所有日志的默认关联键
                 const r = msg;
                 setSlogDefaults({ machine_id: r.machineId, workspace_id: r.workspaceId });
+                if (opts.storageMigration?.ready === true && typeof r.workspaceId === "string") {
+                    try {
+                        opts.storageMigration.bindServerIdentity?.({ workspaceId: r.workspaceId });
+                        machineHelloPublisher.republish();
+                    }
+                    catch (error) {
+                        dslog("daemon.storage_identity_bind_failed", "存储迁移 Workspace 身份绑定失败", {
+                            level: "ERROR", error_message: error.message,
+                        });
+                    }
+                }
                 // 旧 server 无此字段 → 空集合(daemon 保持全部旧行为)。
                 serverCapabilities = new Set(Array.isArray(r.serverCapabilities)
                     ? r.serverCapabilities.filter((c) => typeof c === "string")
@@ -868,6 +930,8 @@ export function serve(config, opts = {}) {
             }
             if (msg.type !== "agent:start")
                 return; // ready/error 等忽略
+            if (storageMigrationRuntime.isAdmissionClosed())
+                return;
             // 任务键:scheduled run 用 runId(每次运行独立 cwd/work-log;overlap 由 server 端 skip_if_running 管,
             // daemon 的 running 去重只兜底"同一 run 重复投递");普通唤醒仍是 线程锚点 ?? 频道。
             const scheduled = msg.reason === "scheduled_job" && msg.scheduledRun
@@ -1283,6 +1347,7 @@ export function serve(config, opts = {}) {
             concurrencyTelemetry.stop();
             runtimeProbe.stop();
             completionRetransmitter.stop();
+            storageStatusDelivery.stop();
             const deadline = createShutdownDeadline(shutdownTimeoutMs);
             if (reconnectTimer !== null) {
                 clearTimeout(reconnectTimer);

package/dist/storage-config.js

@@ -0,0 +1,175 @@
+import { readFile } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+import { z } from "zod";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
+import { resolveEnvTag, resolveNowworkHome, storageLayout, } from "./storage-layout.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
+const PORTABLE_ABSOLUTE_PATH = z.string().min(1).max(32768).refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "must be an absolute path");
+const ServerUrlSchema = z.string().url().max(2048).refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+}, "serverUrl must be HTTP(S) without embedded credentials");
+const InstallationRecordSchema = z.object({
+    version: z.literal(1),
+    installationId: z.string().uuid(),
+    profile: z.string().regex(PROFILE),
+    serverUrl: ServerUrlSchema,
+    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
+    workspaceId: z.string().uuid(),
+    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
+    nowworkHome: PORTABLE_ABSOLUTE_PATH,
+    runtimeRoot: PORTABLE_ABSOLUTE_PATH,
+    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
+    storageMigrationId: z.string().uuid().optional(),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true }),
+}).strict();
+const InstallationRegistrySchema = z.object({
+    version: z.literal(1),
+    installations: z.array(InstallationRecordSchema).max(256),
+}).strict();
+export function findInstallationForProfile(records, profile) {
+    if (!PROFILE.test(profile))
+        throw new Error("profile name is invalid");
+    const matches = records.filter((record) => record.profile === profile);
+    if (matches.length > 1)
+        throw new Error(`Multiple installations use profile '${profile}'`);
+    return matches[0] ?? null;
+}
+const pathsFor = (platform) => platform === "win32" ? win32 : posix;
+function absoluteBase(value, fallback, platform, name) {
+    const paths = pathsFor(platform);
+    const selected = value ?? fallback;
+    if (!paths.isAbsolute(selected) || selected.includes("\0") || selected.includes("\n") || selected.includes("\r")) {
+        throw new Error(`${name} must be an absolute single-line path`);
+    }
+    return paths.normalize(selected);
+}
+export function resolveLocalStorageRoots(input) {
+    const paths = pathsFor(input.platform);
+    const userHome = absoluteBase(input.userHome, input.userHome, input.platform, "user home");
+    if (input.platform === "win32") {
+        const local = absoluteBase(input.environment.LOCALAPPDATA, paths.join(userHome, "AppData", "Local"), input.platform, "LOCALAPPDATA");
+        const root = paths.join(local, "NowWork");
+        return Object.freeze({
+            configRoot: paths.join(root, "config"),
+            runtimeBase: paths.join(root, "runtime"),
+            cacheRoot: paths.join(root, "cache"),
+            stateRoot: paths.join(root, "state"),
+            backupsRoot: paths.join(root, "state", "backups"),
+            runtimePackagesRoot: paths.join(root, "cache", "runtime-packages"),
+        });
+    }
+    if (input.platform === "darwin") {
+        const applicationSupport = paths.join(userHome, "Library", "Application Support", "NowWork");
+        const cacheRoot = paths.join(userHome, "Library", "Caches", "NowWork");
+        return Object.freeze({
+            configRoot: paths.join(applicationSupport, "config"),
+            runtimeBase: paths.join(cacheRoot, "runtime"),
+            cacheRoot,
+            stateRoot: paths.join(applicationSupport, "state"),
+            backupsRoot: paths.join(applicationSupport, "state", "backups"),
+            runtimePackagesRoot: paths.join(cacheRoot, "runtime-packages"),
+        });
+    }
+    const configHome = absoluteBase(input.environment.XDG_CONFIG_HOME, paths.join(userHome, ".config"), input.platform, "XDG_CONFIG_HOME");
+    const cacheHome = absoluteBase(input.environment.XDG_CACHE_HOME, paths.join(userHome, ".cache"), input.platform, "XDG_CACHE_HOME");
+    const stateHome = absoluteBase(input.environment.XDG_STATE_HOME, paths.join(userHome, ".local", "state"), input.platform, "XDG_STATE_HOME");
+    const runtimeHome = absoluteBase(input.environment.XDG_RUNTIME_DIR, paths.join(stateHome, "nowwork", "runtime"), input.platform, "XDG_RUNTIME_DIR");
+    const stateRoot = paths.join(stateHome, "nowwork");
+    const cacheRoot = paths.join(cacheHome, "nowwork");
+    return Object.freeze({
+        configRoot: paths.join(configHome, "nowwork"),
+        runtimeBase: input.environment.XDG_RUNTIME_DIR === undefined ? runtimeHome : paths.join(runtimeHome, "nowwork"),
+        cacheRoot,
+        stateRoot,
+        backupsRoot: paths.join(stateRoot, "backups"),
+        runtimePackagesRoot: paths.join(cacheRoot, "runtime-packages"),
+    });
+}
+export function buildStorageConfig(input) {
+    if (!PROFILE.test(input.profile))
+        throw new Error("profile name is invalid");
+    if (!UUID.test(input.workspaceId))
+        throw new Error("workspace id must be a UUID");
+    const paths = pathsFor(input.platform);
+    const local = resolveLocalStorageRoots(input);
+    const home = resolveNowworkHome({
+        ...(input.nowworkHome === undefined ? {} : { explicit: input.nowworkHome }),
+        ...(input.environment.NOWWORK_HOME === undefined ? {} : { environment: input.environment.NOWWORK_HOME }),
+        userHome: input.userHome,
+        platform: input.platform,
+    });
+    const credentialRef = `profile:${input.profile}`;
+    if (home.mode === "legacy") {
+        return Object.freeze({
+            mode: "legacy",
+            profile: input.profile,
+            workspaceId: input.workspaceId.toLowerCase(),
+            credentialRef,
+            daemonHome: input.legacyDaemonHome ?? paths.join(input.userHome, ".crew", "daemon"),
+            agentsRoot: input.legacyAgentsRoot ?? paths.join(input.userHome, ".crew", "agents"),
+            layout: null,
+            local,
+            diagnostics: Object.freeze(["legacy_storage_detected"]),
+        });
+    }
+    const environment = resolveEnvTag({
+        ...(input.envTag === undefined ? {} : { explicit: input.envTag }),
+        ...(input.environment.NOWWORK_ENV_TAG === undefined ? {} : { environment: input.environment.NOWWORK_ENV_TAG }),
+    }).environment;
+    const layout = storageLayout({
+        nowworkHome: home.root,
+        environment,
+        workspaceId: input.workspaceId,
+        runtimeBase: local.runtimeBase,
+        platform: input.platform,
+    });
+    return Object.freeze({
+        mode: "standard",
+        profile: input.profile,
+        workspaceId: input.workspaceId.toLowerCase(),
+        credentialRef,
+        daemonHome: local.configRoot,
+        agentsRoot: layout.agentItemsRoot,
+        layout,
+        local,
+        diagnostics: Object.freeze([]),
+    });
+}
+export function installationsPath(configRoot) {
+    const paths = win32.isAbsolute(configRoot) && !posix.isAbsolute(configRoot) ? win32 : posix;
+    return paths.join(configRoot, "installations.json");
+}
+export async function readInstallations(input) {
+    const path = installationsPath(input.configRoot);
+    try {
+        const parsed = InstallationRegistrySchema.parse(JSON.parse(await readFile(path, "utf8")));
+        return Object.freeze(parsed.installations.map((record) => Object.freeze(record)));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return Object.freeze([]);
+        throw new Error(`Invalid installation registry: ${path}`, { cause: error });
+    }
+}
+export async function writeInstallations(records, input) {
+    let parsed;
+    try {
+        parsed = InstallationRegistrySchema.parse({ version: 1, installations: records });
+        const installationIds = new Set();
+        const profiles = new Set();
+        for (const record of parsed.installations) {
+            if (installationIds.has(record.installationId) || profiles.has(record.profile)) {
+                throw new Error("duplicate installation identity");
+            }
+            installationIds.add(record.installationId);
+            profiles.add(record.profile);
+        }
+    }
+    catch (error) {
+        throw new Error("Invalid installation metadata", { cause: error });
+    }
+    await atomicPrivateWrite(installationsPath(input.configRoot), `${JSON.stringify(parsed, null, 2)}\n`);
+}

package/dist/storage-control.js

@@ -0,0 +1,193 @@
+import { z } from "zod";
+export const STORAGE_MIGRATION_CAPABILITY = "storage_migration_v1";
+export const STORAGE_MIGRATION_STATUS_CAPABILITY = "storage_migration_status_v1";
+const IdentitySchema = z.object({
+    migrationId: z.string().uuid(),
+    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
+    workspaceId: z.string().uuid(),
+});
+const DoctorRequestSchema = IdentitySchema.extend({ type: z.literal("daemon:storage-doctor") }).strict();
+const MigrateRequestSchema = IdentitySchema.extend({
+    type: z.literal("daemon:storage-migrate"),
+    manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
+}).strict();
+const StatusSchema = z.enum([
+    "preflight_running", "preflight_passed", "backing_up", "initial_sync", "quiescing", "final_sync", "verified",
+    "service_switched", "hello_confirmed", "completed", "failed", "rollback_pending", "rolled_back",
+    "rollback_failed",
+]);
+const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
+const safeError = (error) => (error instanceof Error ? error.message : String(error))
+    .replaceAll(TOKEN, "<redacted>").slice(0, 500) || "storage migration failed";
+const stableErrorCode = (candidate, fallback) => typeof candidate === "string" && /^[a-z0-9._-]{1,128}$/u.test(candidate) ? candidate : fallback;
+export function createStorageControlController(input) {
+    const environment = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u).parse(input.environment);
+    const workspaceId = z.string().uuid().parse(input.workspaceId);
+    const profile = z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u).parse(input.profile);
+    const sourceStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.sourceStorageFingerprint);
+    const targetStorageFingerprint = z.string().regex(/^sha256:[0-9a-f]{64}$/u).parse(input.targetStorageFingerprint);
+    const preflights = new Map();
+    const preflightRuns = new Map();
+    const appliedMigrationIds = new Set();
+    let runningMigrationId = null;
+    const preflightTimeoutMs = z.number().int().positive().max(24 * 60 * 60 * 1000)
+        .parse(input.preflightTimeoutMs ?? 30 * 60 * 1000);
+    const frame = (identity, status, extra = {}) => ({
+        type: "daemon:storage-migration-status",
+        migrationId: identity.migrationId,
+        status,
+        environment,
+        workspaceId,
+        profile,
+        ...extra,
+    });
+    const failure = (identity, errorCode, error, reopenAdmission = false, extra = {}) => {
+        input.sendStatus(frame(identity, "failed", {
+            errorCode,
+            ...extra,
+            ...(error === undefined ? {} : { errorMessage: safeError(error) }),
+            ...(reopenAdmission || error?.reopenAdmission === true
+                ? { reopenAdmission: true }
+                : {}),
+        }));
+    };
+    const matchesIdentity = (identity) => identity.environment === environment && identity.workspaceId === workspaceId;
+    const preflightKey = (identity) => `${identity.migrationId}\0${identity.environment}\0${identity.workspaceId}`;
+    const runPreflight = (identity, failureFallback = "doctor_failed") => {
+        const key = preflightKey(identity);
+        const existing = preflightRuns.get(key);
+        if (existing !== undefined)
+            return existing;
+        const controller = new AbortController();
+        let scannedEntries = 0;
+        let timedOut = false;
+        input.sendStatus(frame(identity, "preflight_running", {
+            progress: { state: "running", scannedEntries: 0 },
+        }));
+        const doctorPromise = Promise.resolve().then(() => input.runDoctor(identity.migrationId, {
+            signal: controller.signal,
+            onProgress: (progress) => {
+                if (timedOut)
+                    return;
+                scannedEntries = progress.scannedEntries;
+                input.sendStatus(frame(identity, "preflight_running", {
+                    progress: { state: "running", scannedEntries },
+                }));
+            },
+        }));
+        let timeoutHandle;
+        const timeout = new Promise((_, reject) => {
+            timeoutHandle = setTimeout(() => {
+                timedOut = true;
+                controller.abort();
+                reject(Object.assign(new Error("storage doctor preflight timed out"), {
+                    code: "preflight_stale",
+                    scannedEntries,
+                }));
+            }, preflightTimeoutMs);
+            timeoutHandle.unref?.();
+        });
+        void doctorPromise.catch(() => undefined);
+        let outcome;
+        outcome = Promise.race([doctorPromise, timeout]).then((doctor) => {
+            if (doctor.manifest.migrationId !== identity.migrationId
+                || doctor.environment !== environment || doctor.workspaceId !== workspaceId
+                || doctor.profile !== profile) {
+                failure(identity, "storage_identity_mismatch", undefined, true);
+                return null;
+            }
+            if (!doctor.applyAllowed) {
+                failure(identity, doctor.blockers[0]?.code ?? "doctor_blocked", undefined, true);
+                return null;
+            }
+            preflights.set(identity.migrationId, doctor);
+            input.sendStatus(frame(identity, "preflight_passed", {
+                sourceStorageFingerprint,
+                targetStorageFingerprint,
+                manifestDigest: doctor.manifestDigest,
+            }));
+            return doctor;
+        }).catch((error) => {
+            const code = error.code;
+            if (code === "preflight_stale") {
+                failure(identity, "preflight_stale", undefined, true, {
+                    retryable: true,
+                    progress: { state: "stale", scannedEntries: Number(error.scannedEntries) || scannedEntries },
+                });
+            }
+            else if (code === "preflight_aborted") {
+                failure(identity, "preflight_aborted", error, true, {
+                    retryable: true,
+                    progress: { state: "stale", scannedEntries },
+                });
+            }
+            else {
+                failure(identity, stableErrorCode(code, failureFallback), error, true);
+            }
+            return null;
+        }).finally(() => {
+            if (timeoutHandle !== undefined)
+                clearTimeout(timeoutHandle);
+            if (preflightRuns.get(key) === outcome)
+                preflightRuns.delete(key);
+        });
+        preflightRuns.set(key, outcome);
+        return outcome;
+    };
+    const handle = async (raw) => {
+        const type = typeof raw === "object" && raw !== null && "type" in raw ? raw.type : null;
+        if (type !== "daemon:storage-doctor" && type !== "daemon:storage-migrate")
+            return false;
+        const schema = type === "daemon:storage-doctor" ? DoctorRequestSchema : MigrateRequestSchema;
+        const parsed = schema.safeParse(raw);
+        if (!parsed.success)
+            return true;
+        const identity = parsed.data;
+        if (!matchesIdentity(identity)) {
+            failure(identity, "storage_identity_mismatch", undefined, true);
+            return true;
+        }
+        if (type === "daemon:storage-doctor") {
+            await runPreflight(identity);
+            return true;
+        }
+        if (runningMigrationId !== null) {
+            if (runningMigrationId !== identity.migrationId)
+                failure(identity, "migration_active");
+            return true;
+        }
+        const migrate = MigrateRequestSchema.parse(identity);
+        if (appliedMigrationIds.has(identity.migrationId))
+            return true;
+        let doctor = preflights.get(identity.migrationId);
+        if (doctor === undefined) {
+            const rebuilt = await runPreflight(identity, "preflight_rebuild_failed");
+            if (rebuilt === null)
+                return true;
+            doctor = rebuilt;
+        }
+        if (!doctor.applyAllowed || doctor.manifestDigest !== migrate.manifestDigest
+            || doctor.manifest.migrationId !== identity.migrationId
+            || doctor.environment !== environment || doctor.workspaceId !== workspaceId || doctor.profile !== profile) {
+            failure(identity, "preflight_digest_mismatch", undefined, true);
+            return true;
+        }
+        preflights.delete(identity.migrationId);
+        runningMigrationId = identity.migrationId;
+        try {
+            await input.runMigration(doctor, (status) => {
+                if (StatusSchema.safeParse(status).success)
+                    input.sendStatus(frame(identity, status));
+            });
+            appliedMigrationIds.add(identity.migrationId);
+        }
+        catch (error) {
+            failure(identity, stableErrorCode(error.code, "storage_migration_failed"), error);
+        }
+        finally {
+            runningMigrationId = null;
+        }
+        return true;
+    };
+    return Object.freeze({ handle });
+}